CVE-2023-35941: Envoy vulnerable to OAuth2 credentials exploit with permanent validity
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
Other sources
Malicious client is able to construct credentials with permanent validity in some specific scenario. This is caused by some rare scenarios, like the combination of host and expire time, in which HMAC payload can be always valid in OAuth2 filter's HMAC check.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-35941?
CVE-2023-35941 is a vulnerability in the Envoy proxy that allows a malicious client to construct credentials with permanent validity in specific scenarios.
What is the severity of CVE-2023-35941?
CVE-2023-35941 has a severity rating of 9.8 (Critical).
How does CVE-2023-35941 affect Envoy?
CVE-2023-35941 affects Envoy versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12.
How can I fix CVE-2023-35941?
To fix CVE-2023-35941, you should update Envoy to version 1.27.0, 1.26.4, 1.25.9, 1.24.10, or 1.23.12.
Where can I find more information about CVE-2023-35941?
You can find more information about CVE-2023-35941 on the Envoy GitHub security advisory page and the Red Hat advisory page.